Chapter 15: Cooperation and consistency – Unlocking the EU General Data Protection Regulation

Under the GDPR, the position on this issue has materially changed (e.g., the GDPR has introduced a new obligation that did not previously exist).

Under the GDPR, the position on this issue has not materially changed (e.g., although the wording may be different in the GDPR, the nature of the relevant obligation is unchanged).

The impact of the GDPR on this issue is likely positive for most organisations (e.g., because the GDPR provides certainty in relation to a previously unclear issue).

The impact of the GDPR on this issue is likely neutral for most organisations (e.g., because the requirements under the GDPR and the Directive are essentially the same).

The impact of the GDPR on this issue is likely negative for most organisations (e.g., because the GDPR introduced a new obligation on organisations).

The impact of the GDPR on this issue is unknown at this stage (e.g., because the impact on organisations is dependent upon secondary guidance that has not yet been written).

The Consistency Mechanism

The core aim of the Consistency Mechanism is to ensure that EU data protection law is enforced uniformly across all Member States.

Art.28(1)

Under the Directive, organisations operating in more than one Member State dealt with the DPA in each Member State in which such an organisation operated.

 Rec.132-134; Art.63, 64(2)

DPAs across all Member States are required to co-operate with each other and with the EDPB and the Commission, to ensure consistent application of the GDPR.

 The GDPR provides for mandatory cooperation between national DPAs and provides that cases considered to have an impact in more than one Member State may be referred to the EDPB. This should help to ensure that organisations face more consistent compliance requirements across the EU.

Opinion of the EDPB

Even if the applicable national data protection laws set similar standards across all Member States, enforcement requirements, attitudes, and standards may vary from Member State to Member State. Ensuring similar enforcement standards is a core issue for EU data protection law.

N/A

The Directive did not provide for DPAs to submit their decisions to a central authority.

 Rec.136; Art.64

DPAs must submit a draft to the EDPB before taking any of the following measures:

• specifying processing measures that should be subject to an Impact Assessment (see Chapter 12);
• approving a Code of Conduct (see Chapter 12);
• approving accreditation criteria (see Chapter 12);
• determining the content of DPA Clauses (see Chapter 13);
• authorising ad hoc clauses (see Chapter 13); or
• approving BCRs (see Chapter 13).

The EDPB may examine each such measure and issue an opinion where the matter in question affects multiple Member States. The relevant DPA must take "utmost account" of the EDPB's opinion in proceeding with its decision.

 DPAs are required to submit to the EDPB decisions that are likely to affect data subjects or organisations in multiple Member States. In theory, this will ensure that DPAs take decisions in a manner that is consistent with the approach that the other affected DPAs would take on the same issues, resulting in a more consistent application of the law across the EU.

 Involving the EDPB as a new step in the decision- making process may result in additional delays.

Dispute resolution by the EDPB

Where DPAs disagree with one another there is a risk of inconsistent application of data protection law across the EU. Allowing a central authority to make binding decisions reduces this risk.

N/A

The Directive did not provide for a central authority to make decisions that were binding on DPAs.

 Rec.136; Art.65

Where DPAs disagree about key data protection law issues, the EDPB will issue a binding decision, which must then be adopted by the Concerned DPA(s) within one month of notification of the EDPB's decision.

 Resolution of disputes by the EDPB should ensure a more consistent application of the GDPR.

Urgency procedure

One drawback of requiring DPAs to refer enforcement issues to a central authority is that this may lead to delays. In many cases, the delay might not prejudice the outcome of the proceedings, but there is a risk that, in some cases, it may do so. Therefore, there is a need to allow for more rapid decisions in cases of urgency.

N/A

The Directive did not directly address this issue.

 Rec.137; Art.66

Where a DPA considers there to be an urgent need to act to protect data subjects' rights, it may immediately adopt provisional measures for up to three months. A full explanation should be provided to other Concerned DPAs, the EDPB and the Commission. Urgent opinions may also be requested from the EDPB.

 This provision allows urgent measures to be taken by DPAs in exceptional circumstances. The inclusion of the EDPB in the decision- making process may result in delays, but the urgency procedure reduces this risk, to a certain extent.

Exchange of information

In order to ensure that EU data protection law is applied consistently, it is important to ensure that DPAs and the EDPB are communicating clearly.

N/A

The Directive did not directly address this issue.

 Rec.116, 168; Art.47(3), 50, 60(1), 61(3), (9), 67, 70(c), (u)-(w)

The Commission may implement acts which specify arrangements for electronic exchange of information between DPAs and the EDPB. The EDPB may advise on these issues.

 This provision is designed to ensure a free flow of information between Concerned DPAs and the EDPB.